提出WebSentinel，精准检测并定位网页中的提示注入攻击。
WebSentinel: Detecting and Localizing Prompt Injection Attacks for Web Agents
- 分两步：先提取可疑内容段，再以页面上下文验证其一致性。
- 在多个自建数据集上显著优于现有基线方法。
- 适合关注网页代理安全的开发者和研究人员。
提示注入攻击通过操控网页内容，诱导网页代理执行攻击者指定的任务而非用户原本意图。现有检测与定位方法在网页代理场景下效果有限，因其假设常不成立。本文提出WebSentinel，一种两阶段检测与定位提示注入攻击的方法：第一步提取可能被污染的感兴趣内容段；第二步通过检查各段与网页整体内容的一致性进行评估。实验表明，WebSentinel在多个自建的含污染与干净网页数据集上均显著优于基线方法。代码已公开于https://github.com/wxl-lxw/WebSentinel。
原文摘要 · Abstract (English)
Prompt injection attacks manipulate webpage content to cause web agents to execute attacker-specified tasks instead of the user's intended ones. Existing methods for detecting and localizing such attacks achieve limited effectiveness, as their underlying assumptions often do not hold in the web-agent setting. In this work, we propose WebSentinel, a two-step approach for detecting and localizing prompt injection attacks in webpages. Given a webpage, Step I extracts \emph{segments of interest} that may be contaminated, and Step II evaluates each segment by checking its consistency with the webpage content as context. We show that WebSentinel is highly effective, substantially outperforming baseline methods across multiple datasets of both contaminated and clean webpages that we collected. Our code is available at: https://github.com/wxl-lxw/WebSentinel.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。